[Webinar] Streamline your web hosting managementRegister Today

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 210
  • Last Modified:

the worm got me ....

Windows98se, Norton SystemWorks 2001, last definition dated 7/25/01.  Norton's automatic system guard caught an infected c:\windows\system\SCan32.exe file with the w32.sircam.worm@mm.virus. The problem is that this file will not delete, will not repair, will not go away. I have renamed it, moved it, quarantined it and tried to repair it but it is still there - and will not allow the system to boot execpt into safe mode.    
Any ideas on how to get rid of this virus and go on with life?
0
waco
Asked:
waco
1 Solution
 
dew_associatesCommented:
Waco,

Here's a URL to the tool need to fix this:

http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.removal.tool.html

Dennis

PS: Here's some additional info from McAfee

http://dispatch.mcafee.com/dispatches/sir_cam/
0
 
AdihCommented:
the tool dew referred you too attempts to delete the infected files and then removes all changes in registry and such, but note that after restart u should check for the file - if its there infected or if its missing,
run sfc from the command line to recover all lost/damaged system files.

i suspect this will also get rid of the infected file but be sure to run the program that u were referred to by dew in order to fix all damages.

good luck, adi.
0
 
Don ThomsonCommented:
The SirCam Virus installs itsel;f in the system registry to load everytime you try and run an EXE  file. Load regedit (if it won't load - rename the regedit.exe to regedit.com first)

In the first group, HKEY_CLASSES_ROOT  goto exefile open to Shell/open/command  if the virus is stil active you will see the value as "C:\recycled\Sircam.exe""%1"%*
Change it to just "%1"%*

Close registry

This will stop it from executing every time you try and run anything. Make sure that the Recyled folder in no excluded in any of you Virus programs. Set Vscan to auto clean - not prompt or quarantine.

Then run SFC to check for damaged system files
0
Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

 
derothCommented:
I also found an entry in the autoexec on several cases of this.   Be sure it is deleted from the autoexec if it is in there.  It was calling for the startup of sircam.exe as it does in the registry.   I also found the sfc repair was essential to get it totally cleaned out. Agree with all the above.
0
 
centervCommented:
The tool did not work for me.  Win ME
Could not recognize that the restore option was shut down.

Did remove manually following procedure.

http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.html
0
 
wacoAuthor Commented:
Thanks all - it gets worse. There may be a dual problem here, one with the virus and the other with Norton's System Works 2001. The system is halted during boot up by the Norton (DOS looking) screen warning of the attack and offering several choices, delete file, skip, quarantine, etc., but whatever option is chosen results in a blank black screen and a system freeze. I am now told that the floppie does not work so I cannot use the cure via a disk. I can however get into safe mode but cannot run the dial up from there to download. Is there a manual step_by_step procedure out there?
0
 
wacoAuthor Commented:
Thanks all - it gets worse. There may be a dual problem here, one with the virus and the other with Norton's System Works 2001. The system is halted during boot up by the Norton (DOS looking) screen warning of the attack and offering several choices, delete file, skip, quarantine, etc., but whatever option is chosen results in a blank black screen and a system freeze. I am now told that the floppie does not work so I cannot use the cure via a disk. I can however get into safe mode but cannot run the dial up from there to download. Is there a manual step_by_step procedure out there?
0
 
centervCommented:
check the above link and scroll down to
MANUAL REMOVAL
0

Featured Post

Learn to develop an Android App

Want to increase your earning potential in 2018? Pad your resume with app building experience. Learn how with this hands-on course.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now